Deploy #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| # One job, three triggers. Every run rebuilds the corpus from the live sources, | |
| # builds the index, and deploys - so push and scheduled deploys are identical and | |
| # nothing (corpus/index) is committed to git. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "src/**" | |
| - "config.toml" | |
| - "template.yaml" | |
| - "samconfig.toml" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "Makefile" | |
| - "scripts/**" | |
| - ".github/workflows/deploy.yml" | |
| schedule: | |
| - cron: "0 8 * * *" # daily: pick up new FAQ/docs/repo content | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # OIDC for AWS credentials | |
| contents: read | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v5 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.14" # must match the Lambda runtime (index is Python-version-tagged) | |
| - name: Unit tests | |
| run: uv run --group test python -m pytest tests -q | |
| - name: Rebuild corpus, config and index from the live sources | |
| run: | | |
| uv run --group ingest python scripts/build_search_corpus.py | |
| uv run python scripts/compile_config.py | |
| uv run python scripts/build_search_index.py | |
| - name: Smoke-test the handler | |
| run: uv run python scripts/check_handler.py | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Deploy with SAM | |
| run: | | |
| uv run sam build | |
| uv run sam deploy \ | |
| --no-confirm-changeset \ | |
| --no-fail-on-empty-changeset \ | |
| --stack-name faq-assistant \ | |
| --resolve-s3 \ | |
| --capabilities CAPABILITY_IAM \ | |
| --parameter-overrides \ | |
| OpenAIApiKey=${{ secrets.OPENAI_API_KEY }} \ | |
| SharedSecret=${{ secrets.FAQ_ASSISTANT_SHARED_SECRET }} |